Your Streaming Box Is Lying to You — Plus US Water Utilities Under Attack
Thursday, August 6, 2026 · 5-minute read
Cyberattacks on US water and wastewater utilities have been reported in at least seven states since July 27, according to a joint alert from the FBI and EPA. Security firm Forescout found 22 internet-facing Rockwell PLCs sitting in cities that were hit — and 19 of those shared the same mobile carrier network, a suspicious pattern. The attackers didn't need a software flaw: they simply reached controllers that were already exposed to the internet, changed settings, and locked out operators.
↗ The Hacker NewsA Canadian man has pleaded guilty to breaking into company accounts at cloud storage provider Snowflake and stealing data from at least 165 organizations. The scheme involved extorting millions of dollars from victims whose data was taken. This case follows the 2024 wave of Snowflake-linked breaches that hit major companies including Ticketmaster and AT&T.
↗ BleepingComputerMaksim Silnikau, the man who built and ran the Ransom Cartel ransomware operation, was sentenced to 16 years in federal prison. His gang attacked at least 18 companies worldwide. The sentencing is one of the stiffest handed down to a ransomware operator and sends a clear message that international cybercrime prosecution is getting more effective.
↗ BleepingComputerFive cryptocurrency wallet apps were using a broken random number generator inside a popular JavaScript library called CryptoJS — one that's been flawed for 12 years. When these apps created your recovery phrase, they used weak randomness, making phrases guessable by attackers. Security firm Coinspect traced at least $5.7 million in theft across two sweeps since late May. The affected apps are RRWallet (discontinued, no fix), Bexo Wallet (fixed in v20.1.0), NanChat (fixed in v1.3.0), Bitcoin Libre (fixed in v4), and Milo. If you used any of these apps before their fix dates, your wallet may be at risk.
Attackers are running a phishing campaign that plays on fears about a recently disclosed vulnerability in COLDCARD hardware wallets and a reported $88.6 million Bitcoin theft. The fake emails push victims to install ScreenConnect, a legitimate remote-access program that then hands attackers full control of the victim's computer. This is a classic fear-based lure: real security news used as bait to spread malware.
Attackers found a SQL injection vulnerability in a public-facing web app's autocomplete search field. From there, they fed Java code directly into an Oracle database and made the database compile and run it — giving them full SYSTEM-level control of the underlying Windows server, all without ever dropping a traditional malware file to disk. Security firm Huntress discovered the attack after detecting credential theft on July 27 and named the toolkit "khunt."
Status: No Oracle patch fixes this — the flaw is in the application layer and the over-privileged database account. Organizations should audit Oracle installations for objects with names beginning "Khunt" and review database account privileges immediately.
Apple's iCloud Private Relay is supposed to hide your real IP address by routing your traffic through two separate relays. Researchers Talal Haj Bakry and Tommy Mysk found that three features in WebKit — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — bypass the relay entirely and send traffic directly from your device. This affects Safari and every third-party browser on iOS and iPadOS, including Chrome, Firefox, and Edge.
Status: No patch available yet. If hiding your IP is critical to your safety, consider using a dedicated VPN instead of relying solely on iCloud Private Relay for now.
CISA issued an emergency directive giving federal agencies just three days to patch vulnerabilities in three widely used enterprise tools: IBM Langflow (an AI workflow builder), N-central (an IT management platform), and Apache Tomcat (a popular web server). All three flaws are being actively exploited in the wild right now, meaning attackers already know how to use them.
Status: Patches available for all three. If your organization runs any of these, treat this as urgent — apply vendor updates immediately.
Microsoft Security has catalogued a new type of attack called AI Recommendation Poisoning, and it requires no hacking skills to pull off. Websites embed hidden instructions inside the "Ask AI" buttons that open ChatGPT, Claude, or Gemini with a pre-filled question. When you click one, the AI silently receives a command telling it to permanently remember that website as a "trusted source" — quietly biasing every future answer it gives you in that vendor's favor. Microsoft found 31 companies across 14 industries already deploying this tactic, with over 50 distinct hidden prompt injections spotted in a single data set. Most are subtle enough that users never notice anything happened. This is worth knowing because it means AI assistants can be quietly manipulated to recommend products or services without you realizing it.
↗ The Hacker NewsThat cheap Android TV box you bought online for "unlimited streaming" may be doing a lot more than playing movies. New research from security firm Bitsight reveals that popular H96 streaming devices are secretly part of a massive ad fraud network — and the operation traces back to a Chinese company called Zhejiang Fengwo IoT Technology.
Here's how the scam works. Each H96 box pretends to be a Samsung, Huawei, or Xiaomi smartphone. It then visits thousands of AI-generated websites — fake blogs about health, food, finance, and gaming — and "clicks" on the ads displayed there. Those sites only show ads when visited by a device matching the spoofed phone profile, so real humans browsing the web would never even see them. The ad networks pay out real money for each fake click, funneling cash to shell companies in Hong Kong and Singapore that Bitsight traced back to Fengwo. The company even built a drag-and-drop tool based on Google's Blockly coding language so that low-skilled operators can build new fake websites without knowing how to code.
Bitsight's researcher Pedro Falé discovered all of this by doing something clever: he registered an expired domain name that the H96 boxes were still checking in with. Suddenly, tens of thousands of devices started reporting their hardware details and installed apps to him — and almost every one claimed to be a phone. That single expired domain became a window into the entire operation. This matters for regular people because these devices are still for sale on Amazon right now. You might buy one thinking you're getting a bargain media player, but you'd actually be buying a fraudster's tool that quietly uses your home internet connection.
This story also connects to a broader trend: LG has separately announced it will suspend smart TV apps that turn your television into a residential proxy — after research found over 42% of LG's webOS app store contained software that did exactly that. The lesson is the same whether it's a TV box or a smart TV app: cheap hardware and free apps often have a hidden cost. Stick to reputable brands, check reviews from security researchers, and be suspicious of any device that promises unlimited content for a one-time payment.